wireguard-admin/docs/evidence/milestone-14.md

Milestone 14 acceptance evidence: restart with valid legacy peers

Validated 2026-10-27T21:55:11+02:00 on the native x86_64-unknown-linux-gnu development host. Results below use synthetic saved files, fake service/runtime adapters, and existing pure runtime comparison tests. They do not establish a real systemd restart.

Behavior and review

Restart preview and confirmation now use the complete SavedPeerProjection derived from the authoritative saved configuration. It includes every valid peer's public key and complete normalized AllowedIPs, independently of optional managed alias metadata and the narrower management Client shape. The existing runtime comparator still requires a complete observed peer set and checks all saved peers and routes before verification can be recorded. The management applied snapshot remains absent when it cannot represent the whole saved peer set; no partial Client snapshot is marked applied.

Synthetic fixtures cover a saved managed client alongside metadata-free legacy peers, IPv4-only host routes, and valid subnet routes outside the management model. Preview preserves server bytes and creates no backup. Fake successful service completion plus a full runtime match creates the required pre-restart backup, records verified historical status, and releases deleted-address reservations only after durable installation. Reopening retains that history, starts with runtime Unknown, and does not regain a partial applied snapshot. A missing legacy runtime peer leaves reservations durable and runtime unknown. Malformed AllowedIPs, duplicate public identity, and malformed section headers block preview before backup/service mutation with a secret-free public identity or section line and condition. Existing tests also cover backup failure, service timeout/failure, stale saved generation, runtime mismatch, persistence failure, draft cancellation and SaveConfig rejection.

An independent GPT-6-Luna/high reviewer found no actionable behavior finding. The first coordinator Clippy gate found M14-R1 (P3), a collapsible diagnostic guard in src/app.rs. A separate GPT-6-Luna/high repairer fixed it; the reviewer confirmed equivalent logic and closed R1. The final integrated gates below ran after that repair.

Commands and source identity

Pinned rustc/Cargo 1.97.1, rustfmt 1.9.0 and Clippy 0.1.97 were verified. The following commands ran from the repository root and exited 0 on the integrated revision:

• cargo test --locked app::tests::: 57 passed.
• cargo test --locked --test runtime_restart: 3 passed.
• cargo fmt --all -- --check.
• cargo clippy --locked --all-targets -- -D warnings.
• cargo test --locked: 357 passed, 3 explicitly ignored, 0 failed, including 2 documentation tests.
• cargo build --locked --release.
• git diff --check.

Base commit: 4bb975f122abfdeabbd04fe6b737eec5706596f5. Dirty Rust inputs at validation were src/app.rs, src/domain.rs, and tests/runtime_restart.rs; PLANS.md was dirty with this milestone's execution record. SHA256 inputs:

• src/app.rs: 01cf281f5b8ae62877dcf63ece7d51b5cca5522f6bc5c9e99dbc0e718a4121f4
• src/domain.rs: 179ecbe66ad7b6e022233a6da3b62a6ce57d92d26d32b0ae6c750ccd2edc5f01
• tests/runtime_restart.rs: 4cff0de16a18cccc846ace86808840567165fc110d121fd7bdc459481379e05f

Native release artifact target/release/wireguard-admin SHA256: a7c946297d2a0140ddcca1c15bb3f651fe6ddc494c2eb7e8e713fdfc700e6b5a.

No Alpine rerun, disposable systemd VM, or production operation was performed. The accepted M8 Alpine artifact identity predates this revision; it does not validate this build. M9's real systemd/D-Bus acceptance remains retired and unverified.